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1 Listing of Claims: 

2 CLAIMS 

3 1 . (Currently amended) A method for detecting attacks on a data communications network having 

4 a plurality of addresses for assignment to data processing systems in the network, the method 

5 comprising: 

6 identifying data traffic on the network originating at any assigned address and addressed to any 

7 unassigned address, said unassigned address is an address which is free and not assigned to user 

8 systems; 

9 inspecting any data traffic so identified for data indicative of an attack; and, on detection of data 

10 indicative of an attack, generating an alert signa l, wherein the step of inspecting comprises 

11 spoofing replies to requests contained in the data traffic identified: 

12 on generation of the alert signal, rerouting any data traffic originating at the address assigned to 

13 the data processing system originating the data indicative of the attack to a disinfection address on 

14 the network: 

15 on generation of the alert signal, sending an alert message to the disinfection address: 

16 wherein the alert message comprises data indicative of the attack detected. 

17 on receipt of the alert message, sending a warning message from the disinfection address to the 

18 address assigned to the data processing system originating the data indicative of the attack: 

19 including in the warning message program code for eliminating the attack when executed by the 

20 data processing system originating the data indicative of the attack: 
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1 supporting an entity in the handling of the detected attack by one of providing instructions for use 

2 of assistance in executing, and execution of disinfection program code; 

3 providing a report to said entity containing information related to one of alert, disinfection, 

4 rerouting, logging, discarding of data traffic in the context of a detected attack: 

5 billing said entity for the execution of at least one of the steps of this method, the charge being 

6 billed determined in dependence of one of the size of the network, the number of unassigned 

7 addresses monitored, the number of assigned addresses monitored, the volume of data traffic 

8 ins pected, the number of attacks identified, the number of alerts generated, the signature of the 

9 identified attack, the volume of rerouted data traffic, the degree of network security achieved, the 

10 turnover of said entity, and 

11 providing said steps of identifying, inspecting and generating to a plurality of entities and using 

12 technical data derived from the attack-handling for one of said entities for the attack-handling for 

13 another of said entities, wherein the alert message comprises data indicative of the attack 

14 detected. 

15 2. - 20. (Canceled) 
16 
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